Risk Management

Policy Statement

Purpose Requires that AECOM employees:

This policy establishes the AECOM approach to Risk
Management aiming at identifying, analyzing and
mitigating major risks to AECOM while consistently
delivering world-class and sustainable solutions.
Commitment
AECOM is committed to promoting a culture of risk-based
thinking in all we do, on projects and non-project activities.
The AECOM Risk Management systems include:
• Participate in risk-based training through formal and
on-the-job training.
• Contact ORM for early engagement on key pursuits
or non-project activities to allow planning / pricing of
adequate risk mitigation (prevention, avoidance,
transfer) and early feedback to clients.
• Engage ORM early in the potential claim process so
resolution before escalation to a legal dispute can
occur.

• An Enterprise Risk Management initiative (ERM). The ORM organization and detailed objectives are tailored
• Approval Matrices that define AECOM’s risk to the services of each Business Group and/or Geography
appetite, and are subject to a robust permanent as well as client requirements. The ORM leadership is
improvement process. tasked with providing a consistent approach to risk as well
• Approval processes, assuring that project and as identifying and disseminating best practices.
non-project business decisions can be reviewed
These Risk Management Systems are measured and
thoroughly but timely, in line with the Approval
monitored regularly through ORM Group coordination and
Matrices, and at the right level in the organization.
associated reporting.
• Project Reviews, coordinated throughout the
company so that projects being delivered are
Review and Communication
reviewed at the right level and frequency, with
This policy and any amendments will be regularly reviewed
Corporate ORM oversight on projects with the
and published thru the IMS and available on the AECOM
highest financial, legal and/or technical risk.
intranet ORM page and communicated to persons working
• An Integrated Management System (IMS)
for or on behalf of AECOM.
committed to providing simplified, consolidated
and easy-to-access AECOM Policies, Procedures Sincerely:
and Instructions (PPIs).

Expectations 28 March 2016

The AECOM Risk Management systems rely on the Office Regis Damour Date
of Risk Management (ORM), an integrated group of Chief Risk Officer
corporate and operational risk professionals, working
closely with Legal and Insurance colleagues.

ORM’s ability to
• Facilitate risk-based thinking throughout the
organization, and
• Extract and disseminate lessons learned,
contributing to AECOM’s permanent improvement
process.

R1-100-PL1, Rev 0